🕵️ XSS Scanner — GUI Tool

A Graphical XSS vulnerability testing tool built with Python, Selenium, and Tkinter.
It automatically tests URL parameters and HTML forms against thousands of XSS payloads (built-in + from xss.txt).

---

✨ Features

• ✅ Tests URL parameters & forms
• ✅ Supports 2600+ payloads (from xss.txt, duplicates preserved)
• ✅ Built-in common payloads included
• ✅ Detects JavaScript execution via alert/prompt/confirm
• ✅ Heuristic reflection detection
• ✅ Proxy support (for Burp, ZAP, etc.)
• ✅ Headless mode for stealth testing
• ✅ Multi-threaded scanning
• ✅ Reports in JSON and HTML format
• ✅ GUI interface (Tkinter)

---

📸 Screenshot

Example (GUI window):
()

---

🛠 Requirements

• Python 3.8+
• selenium
• beautifulsoup4
• tkinter (comes pre-installed with Python on most systems)
• Chrome/Chromium + ChromeDriver

⚙️ Installation

1. Clone the repo

https://github.com/cybertushar404/EchoXSS.git
cd EchoXSS

pip install -r requirements.txt

2.Ensure Chrome & ChromeDriver

Install Google Chrome (or Chromium). Install ChromeDriver matching your Chrome version. Alternatively, install undetected-chromedriver for automatic driver management:

pip install undetected-chromedriver

3.Usage

Run the scanner:

python EchoXss.py

Steps:

• Enter a target URL (e.g., http://example.com/search?q=test).
• Provide a payload file
• Configure a proxy (for Burp/ZAP).[Optional]
• Choose number of threads and whether to run in headless mode.
• Click Start to launch the scan.
• Save results as JSON or HTML report.

📊 Example Report

JSON report:

[
  {
    "vector": "URL Parameter",
    "parameter": "search",
    "payload": "<script>alert(1)</script>",
    "evidence": "JS hook triggered",
    "url": "http://target.com/?search=<script>alert(1)</script>"
  }
]

HTML report (screenshot):

⚠️ Disclaimer

This tool is for educational and security testing purposes only. Do NOT use it on systems you don’t own or without explicit permission. I (the author) take no responsibility for misuse.